wicked-garden 12.35.0 → 12.37.0

package/.claude-plugin/components.json

@@ -2,8 +2,8 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search", "smaht"],
   "summary": {
-    "skills": 143,
-    "fork_skills": 78,
+    "skills": 144,
+    "fork_skills": 75,
     "hooks": 13,
     "specialists": 7
   },
@@ -31,6 +31,7 @@
     "engineering-conformance-reviewer": ["engineering-conformance-reviewer"],
     "engineering-migration-engineer": ["engineering-migration-engineer"],
     "engineering-solution-architect": ["engineering-solution-architect"],
+    "governed-worker": ["governed-worker"],
     "ground": ["ground"],
     "integration-discovery": ["integration-discovery"],
     "jam": ["jam"],
@@ -102,7 +103,7 @@
     "workflow": ["workflow"],
     "worktrees": ["worktrees"]
   },
-  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-crew-implementer", "wicked-garden-crew-researcher", "wicked-garden-crew-reviewer", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
+  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
   "hooks": ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "TaskCompleted", "SubagentStart", "SubagentStop", "PermissionRequest", "Notification", "PreCompact", "Stop", "SessionEnd"],
   "specialists": [
     {

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.35.0"}], "version": "12.35.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.37.0"}], "version": "12.37.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.35.0",
+  "version": "12.37.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [12.37.0] — 2026-09-14
+
+### Changed
+- **Evaluator verdicts: one grammar — `VERDICT: PASS` or `VERDICT: FAIL`, one plain-text line, the LAST line of the message (FIX-IT-ALL L6-0; the garden half of D-9, mirrored by wicked-crew's qe review text and wicked-core's evaluator-verdict carrier).** The review surfaces said APPROVE / CONDITIONAL / REJECT in one place (`wicked-garden-governed-worker`), `VERDICT={PASS|CONDITIONAL|FAIL} MODE=produced-test` in another (the `qe` router's `review` action), `{PASS|CONDITIONAL|FAIL|SKIP}` in a third (`qe-security-test-engineer`), TWO verdict lines in one message (`qe-test-code-quality-auditor` §8 + §9) and no verdict line at all in an evaluator skill (`domain-coverage`) — a gate cannot read five spellings. wicked-core's evaluator gate (wave 3, core-ts 0.7.27) reads the LAST `^VERDICT[:=]` line of an evaluator unit's output and passes ONLY on the token `PASS`; any other token — or no line — parks the run at the human gate, never a false pass. Every garden text surface now asks for exactly that: `governed-worker` (evaluator method; output contract item 6 "the contract line — the LAST line of your message"; a self-reviewing seat writes no line and the gate treats that as FAIL), `qe/refs/review.md` (vocabulary + the produced-test dispatch — `MODE: produced-test` on its own line), `qe-test-code-quality-auditor` (the §8 audit line becomes `AUDIT: {p0}/{p1}/{p2} REVIEWER: … RUN_ID: …` with no VERDICT token — a smell audit certifies nothing; §9 carries the ONE contract line with `MODE:` / `REVIEWER:` / `RUN_ID:` on their own lines), `qe-security-test-engineer` (`SKIP` → `VERDICT: FAIL` + `reason: not applicable: <why>` — a review with no security surface parks at the gate instead of passing silently), `qe-a11y-test-engineer` / `qe-ai-feature-test-engineer` / `qe-snapshot-hygiene-auditor` (the footer is the grammar with `REVIEWER:` / `RUN_ID:` on their own lines; CONDITIONAL stays a ledger RECORD value, the output line is FAIL with the conditions listed above it), `domain-coverage` (gains the line: PASS iff `coverage == 1.0`, zero unaccounted and no `BLOCK`), `qe/refs/accept.md` (the acceptance reviewer writes PASS|FAIL; `VERDICT_TO_STATUS` is unchanged — PARTIAL / CONDITIONAL / INCONCLUSIVE are legacy record values readers keep mapping) and `wickedizer/refs/patterns.md` (the comparison template's `VERDICT:` heading is prose again). **Behaviour change (D-9, text half):** CONDITIONAL and SKIP are no longer verdicts — unmet conditions and not-applicable reviews FAIL into the human gate; the wicked-ledger `Verdict` enum and the DomainStore `verdict:` records are untouched (record vocabulary). **Lint:** `tests/test_skill_portability.py` gains the garden-only token `verdict-spelling` — every line-leading `VERDICT[:=]` line under `skills/**/*.md` (fenced blocks included) must be `VERDICT: PASS`, `VERDICT: FAIL` or the template `VERDICT: PASS|FAIL`; nothing that is not line-leading is judged. The legacy `VERDICT=… REVIEWER=… RUN_ID=…` footers of seven `qe-*` specialists already parse as PASS/FAIL and are tolerated ONLY in the files listed under `verdict_spelling.legacy_footer_files` in `tests/portability_rules.garden.json`; a listed file with no footer left fails the build, so the qe batches that rewrite them shrink the list in the same change. **Mixed generations:** a skills generation published from garden ≤ 12.36.0 still writes the old words and gates every evaluator unit under core-ts 0.7.27 — publish garden ≥ 12.37.0 first.
+
+## [12.36.0] — 2026-09-13
+
+### Fixed
+- **Governed grounding goes through the estate stdio shim in `--readonly` with a pinned store — never the raw write CLI (garden#1130; the garden half of wicked-core#463/#471, ledger F-RC1-045/046/048).** Governed workers ground through `scripts/_estate_client.py` (the DEC-R shim the `mem` domain already uses) because an organization-managed Claude Code `allowedMcpServers` allowlist silently drops a handed `wicked-estate` MCP server, while a script the skill runs is unaffected and works on every seat CLI. The shim gains a governed / read-only mode: with `WICKED_RUN_ID` set (or `--readonly` on the backend argv, or `WICKED_ESTATE_READONLY=1`) every spawn is `wicked-estate-mcp --readonly [--db <store>]`; in a run the store MUST be pinned (`--db <path>`, or `WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB` in the worker environment) and an unpinned store is refused without spawning (`{"ok": false, "reason": …}`), the same shape the gate hook denies as `no-pin`. `parse_cli_flags` accepts `--readonly` / `--db <path>` anywhere on a backend argv and rejects any other `--flag` as a usage error (a misspelt `--read-only` would otherwise fall through and spawn a WRITE-capable MCP — the remedy the fence coaches must work); `scripts/mem/estate_memory.py` forwards the flags instead of dropping them (before: `argv[2:]` was ignored, so the fence recorded ALLOW on a write-capable MCP). New shim actions: `propose` (`proposal.submit` — the safe write a read-only MCP still permits; `provenance` is never forwarded, the server stamps it from `WICKED_RUN_*`; returns `{ok,id}` or `{ok:false,reason,code}` so a `-32602` shape error is told apart from an unreachable estate) and `mode` (a no-spawn probe of governed / readonly / store_pinned / refusal). The persistent broker restarts when the read-only mode changes, not only when the db does. **Ladders**: `wicked-garden-search` and `wicked-garden-repo-learn` (and `refs/hotspots.md`, `refs/capture-proposals.md`, the `mem` skill) now open with a governed-run rung — the shim in `--readonly` with the store pinned from the env — then read-only CLI subcommands (`query|blast-radius|rank|stats|source|semantic|cross-graph`, `clusters` without `--annotate`), then grep flagged as missing injected edges; `wicked-estate index|scip|tfstate|import-telemetry|compact|watch` and `clusters --annotate` are never a rung in a governed run; every degrade names the rung that answered; a denied call is final (governed-worker A5). **Capture contract**: the repo-learn capture phase submits each proposal through the shim AND writes the exact `{kind_type, payload, facets}` objects as one JSON array to the deliverable file the run names — an absolute path in the unit's declared write root, never inside the repository (governed-worker E1) — so wicked-crew (crew#553) can land them when the shim path is unavailable on a seat; counts are reported derived / submitted / written-to-file / failed. **Lint**: `tests/test_skill_governed_grounding.py` fails the build when a write-CLI invocation appears in a governed-mode block of any skill text (a block that names the write CLI only to forbid it passes), and asserts the three ladders' governed blocks name the shim with `--readonly`. Release ordering: this must ship before any wicked-core-ts release that contains core#471 — that fence's deny remedy coaches `--readonly`, which shims older than this release ignore.
+
+### Added
+- **`wicked-garden-governed-worker` — the discipline every governed unit follows, by role (creator / evaluator / neutral), in the cross-CLI skill format (garden#1131; the pilot for garden#1132).** Ten distinct governed runs were lost on 2026-09-13 to one failure class: creators shipped without running the repo's checks and called red results "pre-existing" (F-RC1-019, F-RC1-070), hand-edited generated artifacts (F-RC1-019), evaluators wrote notes or fixes into the guarded worktree and were killed by the guard (F-RC1-060/062, F-RC1-071, F-RC2-037), triage units implemented because a steer addressed to the fix phase reached them (F-RC2-038), units asked "Shall I proceed?" into a headless run (F-RC2-038), skills shelled a denied CLI and retried variants (F-RC1-046), and results were reported "done" with nothing submitted (F-RC1-048). New top-level skill `skills/governed-worker/` carries the fourteen rules (A1–A6 for every unit, C1–C5 creator, E1–E2 evaluator, N1 neutral), the role-inference table, an output contract (what you did · commands + exit codes · derived/submitted/failed counts · verdict or plan · open questions as statements) and a Provenance table citing the ledger id behind each rule. Frontmatter is the cross-CLI closed set only — `name`, `description`, `metadata.role: worker`, `metadata.phases: "*"`, `metadata.roles` — no `context: fork`, `subagent_type`, `model`, `effort`, `max-turns`, `color` or `allowed-tools`; the body names tools generically ("your shell", "your file-edit tool", "the handed estate shim in read-only mode"), so codex / pi / opencode / copilot seats can honour it. wicked-core will prepend a role-keyed base-skill directive to every unit prompt (core#468) and wicked-crew will default it (crew#554); until then the skill is handed like any `skill_ref`.
+
+### Changed
+- **`wicked-garden-crew-implementer` / `-crew-reviewer` / `-crew-researcher` retired into `wicked-garden-governed-worker` (Creator / Evaluator / Neutral).** The trio were Claude Code fork-subagent definitions (`context: fork`, `subagent_type`, `model`, `allowed-tools`, `Task(`/`TaskUpdate(` plumbing) that no governed worker was ever handed and no other CLI could honour; their method content (work from the approved design and scenarios in small verified steps; validate against design and evidence with `file:line` verdicts; map structure, name files and risks, hand the plan on) moved into the role sections and each `skills/crew-*/SKILL.md` is now a 7-line redirect stub (`metadata.role: module`). Every in-repo reference follows the fold — swarm (SKILL + `refs/{fan-out,recon-synthesis,ship-discipline,independent-verification}.md`), archetype `refs/review.md`, qe / qe-code-analyzer disambiguation notes, jam-council seat dispatch (now `wicked-garden-governed-worker` with `Role: evaluator`), integration-discovery refs, the smaht delegation hint, the two pre_tool hook messages, the hooks.json #344 note, the site's orchestration group, `.claude/CLAUDE.md`, `.claude/commands/wg-test.md`, and the three tests that pinned worker identity on the trio (repointed to `wicked-garden-engineering-solution-architect`). `components.json` regenerated with `sync_components.py` (fork_skills 78 → 75; skills 143 → 144). No version bump.
+
 ## [12.35.0] — 2026-09-13
 
 ### Added
@@ -841,3 +857,6 @@ through `v9.2.18`. Major themes across that span:
   condition-resolution mechanism, scope-delta HITL trigger.
 
 For each of those releases, see the corresponding tag in git history.
+
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.0...HEAD
+[12.37.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.36.0...v12.37.0

package/hooks/hooks.json

@@ -15,7 +15,7 @@
 
   "_TODO_341_http_hooks": "Issue #341: HTTP hook type (type: 'http') is not supported. When supported, add HTTP hooks for external service integration: POST crew phase transitions to a webhook URL, send gate results to a quality dashboard, notify Slack/Teams on crew project completion. Currently all hooks are type: 'command' (subprocess).",
 
-  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the crew fork-worker skills (skills/crew-implementer, skills/crew-researcher, skills/crew-reviewer) so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel.",
+  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the context:fork worker skills that modify files so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel. (The crew-implementer / crew-researcher / crew-reviewer trio this note used to name was retired 2026-09 into the cross-CLI wicked-garden-governed-worker skill, which carries no fork frontmatter.)",
 
   "_TODO_345_once_flag": "Issue #345: The 'once' flag is not documented as a supported hook property. When supported, add \"once\": true to the SessionStart bootstrap hook so it only fires on the first session start, not on reconnects. Currently bootstrap.py handles this by checking session state for staleness.",
 

package/hooks/scripts/pre_tool.py

@@ -421,8 +421,8 @@ def _check_challenge_gate(file_path: str) -> str:
             f"'{project_name}' (complexity={complexity}). {reason} "
             f"Invoke a contrarian reviewer to produce and clear "
             f"phases/design/challenge-artifacts.md before continuing build. "
-            f"Dispatch the reviewer fork skill: Skill("
-            f"skill='wicked-garden-crew-reviewer') with a contrarian challenge brief. "
+            f"Dispatch a reviewer that follows the evaluator section of the "
+            f"wicked-garden-governed-worker skill with a contrarian challenge brief. "
             f"To bypass temporarily, set WG_CHALLENGE_GATE=off."
         )
     except Exception:
@@ -1064,7 +1064,7 @@ def _warn_reviewer_report(phase_dir: Path, phase_name: str, complexity: int) ->
             f"[wicked-garden] Warning: phases/{phase_name}/reviewer-report.md is missing "
             f"for a complexity-{complexity} project. The async reviewer (Tier 2) should "
             f"have written this. Proceeding with approve, but consider dispatching "
-            f"Skill(skill='wicked-garden-crew-reviewer') to generate a reviewer report."
+            f"a reviewer that follows the wicked-garden-governed-worker skill's evaluator section to generate a reviewer report."
         )
     return ""
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.35.0",
+  "version": "12.37.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_agents.py

@@ -13,7 +13,7 @@ Usage:
 
     loader = AgentLoader()
     loader.load_fork_skills(skills_dir)          # skills/ root
-    profile = loader.get("wicked-garden-crew-implementer")
+    profile = loader.get("wicked-garden-engineering-solution-architect")
 """
 
 import json
@@ -69,7 +69,7 @@ class AgentLoader:
     Lifecycle (called once in bootstrap.py):
         loader = AgentLoader()
         loader.load_fork_skills(skills_dir)
-        profile = loader.get("wicked-garden-crew-implementer")
+        profile = loader.get("wicked-garden-engineering-solution-architect")
     """
 
     def __init__(self) -> None:
@@ -174,7 +174,7 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
 
     Format:
         ---
-        name: wicked-garden-crew-implementer
+        name: wicked-garden-engineering-solution-architect
         description: |
           Optional description
         context: fork                # required when fork_only=True

package/scripts/_estate_client.py

@@ -32,12 +32,46 @@ The spawn-vs-broker choice is an implementation detail behind a single seam:
 and swappable via `set_dispatch()`). Every public function routes through it, so
 **no caller changes** when the transport does.
 
+Governed / read-only mode (wicked-garden #1130, DES-GROUNDING-001 §7)
+------------------------------------------------------------------
+A governed worker (a unit of a wicked-crew run, `WICKED_RUN_ID` set) grounds
+through THIS shim, never through a Claude-Code-registered MCP server (an
+organization-managed `allowedMcpServers` allowlist drops that silently) and
+never through the raw write CLI. In that mode every spawn is
+``wicked-estate-mcp --readonly [--db <store>]``:
+
+* ``--readonly`` is spelled literally — the MCP detects read-only by the exact
+  token and refuses every write tool except the safe ``proposal.submit``.
+  Read-only is on when a governed-unit marker is present (`GOVERNED_MARKERS`:
+  `WICKED_RUN_ID`, or the fence env the wrapped carrier sets on the worker —
+  `WICKED_GATE_SCOPE` / `WICKED_WRITE_ROOTS`), when the caller passed
+  ``--governed`` / ``--readonly`` on the backend argv (`parse_cli_flags` /
+  `set_governed` / `set_readonly`), or when ``WICKED_GOVERNED`` /
+  ``WICKED_ESTATE_READONLY`` is truthy. The markers are a CONFIRMATION, not
+  the definition: the skill text defines governed mode by the handed context
+  (a phase directive / the governed-worker skill), because no carrier stamps
+  `WICKED_RUN_ID` on the worker's own environment today and the ACP carrier
+  hands the child none of the fence env.
+* The store must be PINNED: ``--db <path>`` on the backend argv, or
+  ``WICKED_ESTATE_DB`` / ``WICKED_HOME`` / ``WICKED_MEMORY_DB`` in the worker
+  environment. In a governed run an unpinned store is REFUSED (no spawn,
+  `governed_refusal()` names the fix) — an unpinned MCP would resolve the
+  operator's defaults, which is exactly the leak the fence denies.
+* Backends forward the flags instead of dropping them: `parse_cli_flags(argv)`
+  strips ``--readonly`` / ``--db`` anywhere on argv and REJECTS any other
+  ``--flag`` (a misspelling such as ``--read-only`` must never fall through —
+  the MCP would run write-capable). The wicked-core gate hook allows a shim
+  invocation only with ``--readonly`` AND a pinned store (core #471); this
+  module produces exactly that argv shape for the spawned MCP.
+
 Fail-open contract
 ------------------
 Every public function is fail-open: on a missing binary, spawn failure,
 timeout, non-zero exit, malformed JSON, or a tool `isError`, it returns a safe
 empty value (`False` / `None` / `[]`) and never raises. Hooks degrade; they do
-not crash.
+not crash. The governed refusal above is the one deliberate "do not even try":
+it still returns the empty value — the CLI surfaces the reason as
+``{"ok": false, "reason": …}``.
 
 Cross-platform
 --------------
@@ -108,11 +142,14 @@ def resolve_estate_bin() -> Optional[str]:
 def resolve_db() -> Optional[str]:
     """Resolve the graph DB path, mirroring the binary's own resolution.
 
-    Order: WICKED_ESTATE_DB env > <cwd>/.wicked-estate/graph.db (if present) >
-    None. When None, callers omit `--db` and let the binary apply its default,
-    so we never fight the binary's resolution — we only *pin* it when we have a
-    concrete answer. `:memory:` is honoured (passed through) for tests.
+    Order: an explicit `--db` (`set_db` / `parse_cli_flags`) > WICKED_ESTATE_DB
+    env > <cwd>/.wicked-estate/graph.db (if present) > None. When None, callers
+    omit `--db` and let the binary apply its default, so we never fight the
+    binary's resolution — we only *pin* it when we have a concrete answer.
+    `:memory:` is honoured (passed through) for tests.
     """
+    if _db_override:
+        return _db_override
     env_db = os.environ.get("WICKED_ESTATE_DB")
     if env_db:
         return env_db
@@ -125,6 +162,153 @@ def resolve_db() -> Optional[str]:
     return None
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# Governed / read-only mode — the argv contract the gate hook allows (#1130)
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Governed-unit markers — any of these non-empty in the environment means "you are a
+# unit of a wicked-crew run". `WICKED_RUN_ID` is what wicked-core stamps on the estate
+# MCP SERVER's launch env (`estate_provenance_env`), not on the worker's own Command env,
+# so on its own it is an unreliable cue inside a unit (garden #1134 HIGH-1). The fence
+# env the WRAPPED carrier does set on the worker Command is the reliable marker there —
+# wicked-core main `ad9a0c1`, `src/execute_wrapped.rs:853` (`WRITE_ROOTS_ENV` =
+# "WICKED_WRITE_ROOTS", `src/gate_hook.rs:114`) and `:863` (`GATE_SCOPE_ENV` =
+# "WICKED_GATE_SCOPE", `src/gate_hook.rs:56`). The ACP carrier hands its child none of
+# these today (`gate_hook.rs` `estate_store_pinned_for_child`), which is why the skill
+# text defines governed mode by the HANDED CONTEXT and `--governed` / WICKED_GOVERNED=1
+# let a seat (or a launcher) say so explicitly.
+GOVERNED_RUN_ENV = "WICKED_RUN_ID"
+GOVERNED_MARKERS = (GOVERNED_RUN_ENV, "WICKED_GATE_SCOPE", "WICKED_WRITE_ROOTS")
+GOVERNED_ENV = "WICKED_GOVERNED"              # explicit override (any truthy value)
+GOVERNED_FLAG = "--governed"                  # explicit override on the backend argv
+READONLY_ENV = "WICKED_ESTATE_READONLY"       # explicit read-only opt-in outside a run
+# Any of these, non-empty in the worker environment, pins the store the spawned
+# MCP resolves (the same set wicked-core's shim allow rule reads: core #471).
+STORE_PIN_ENV = ("WICKED_ESTATE_DB", "WICKED_HOME", "WICKED_MEMORY_DB")
+READONLY_FLAG = "--readonly"                  # exact token — the MCP matches it literally
+DB_FLAG = "--db"
+
+_readonly_flag: bool = False                  # set by --readonly / set_readonly()
+_governed_flag: bool = False                  # set by --governed / set_governed()
+_db_override: Optional[str] = None            # set by --db <path> / set_db()
+
+
+def set_governed(flag: bool = True) -> None:
+    """Declare this process a governed unit (`--governed`): read-only + pinned store required."""
+    global _governed_flag
+    _governed_flag = bool(flag)
+
+
+def set_readonly(flag: bool = True) -> None:
+    """Force read-only spawns (`--readonly` on the MCP argv) for this process."""
+    global _readonly_flag
+    _readonly_flag = bool(flag)
+
+
+def set_db(path: Optional[str]) -> None:
+    """Pin the store the spawned MCP opens (`--db <path>`); None clears the pin."""
+    global _db_override
+    _db_override = path or None
+
+
+def _env_truthy(name: str) -> bool:
+    return os.environ.get(name, "").strip().lower() not in ("", "0", "false", "no")
+
+
+def governed_marker() -> Optional[str]:
+    """Which cue says "governed unit": the `--governed` flag, `WICKED_GOVERNED`, or the
+    first `GOVERNED_MARKERS` variable set in the environment. None = no marker seen
+    (which does NOT prove a human session — see the module docstring)."""
+    if _governed_flag:
+        return GOVERNED_FLAG
+    if _env_truthy(GOVERNED_ENV):
+        return GOVERNED_ENV
+    for name in GOVERNED_MARKERS:
+        if os.environ.get(name, "").strip():
+            return name
+    return None
+
+
+def is_governed() -> bool:
+    """True when any governed-unit marker is present (`governed_marker`)."""
+    return governed_marker() is not None
+
+
+def read_only() -> bool:
+    """Spawn the MCP with `--readonly`? Governed run, explicit flag, or env opt-in."""
+    return _readonly_flag or is_governed() or _env_truthy(READONLY_ENV)
+
+
+def store_pinned() -> bool:
+    """Is the store named — `--db` on argv or a pin variable in the environment?"""
+    return bool(_db_override) or any(os.environ.get(k, "").strip() for k in STORE_PIN_ENV)
+
+
+def governed_refusal() -> Optional[str]:
+    """The reason NOT to spawn: a governed run with no pinned store. None = clear to go.
+
+    Belt-and-braces with the gate hook (which denies the same shape as `no-pin`):
+    the shim never resolves the operator's default stores from inside a run.
+    """
+    marker = governed_marker()
+    if marker is None or store_pinned():
+        return None
+    return (
+        f"governed unit ({marker} is set) but no estate store is pinned: pass "
+        f"{DB_FLAG} <path> or set {' / '.join(STORE_PIN_ENV)} in the worker environment; "
+        "refusing to spawn wicked-estate-mcp against an unpinned store (it would resolve "
+        "the operator's defaults)"
+    )
+
+
+def mcp_argv(exe: str, db: Optional[str]) -> list:
+    """The exact argv every transport spawns: `<exe> [--readonly] [--db <db>]`."""
+    argv = [exe]
+    if read_only():
+        argv.append(READONLY_FLAG)
+    if db:
+        argv += [DB_FLAG, db]
+    return argv
+
+
+def parse_cli_flags(argv: list) -> list:
+    """Strip the shim's own flags from a backend argv, apply them, return the rest.
+
+    `--readonly` → `set_readonly(True)`; `--governed` → `set_governed(True)`;
+    `--db <path>` / `--db=<path>` → `set_db`.
+    Flags are accepted ANYWHERE on argv (the gate hook's remedy coaches appending
+    `--readonly` to a denied command). Any other `--flag` raises ValueError — a
+    misspelling (`--read-only`, `--readonly=false`) must never pass through as a
+    positional, because the spawned MCP would then run write-capable. `-`
+    (read JSON from stdin) and JSON objects are positionals and pass through.
+    """
+    rest: list = []
+    it = iter(argv)
+    for tok in it:
+        if tok == READONLY_FLAG:
+            set_readonly(True)
+        elif tok == GOVERNED_FLAG:
+            set_governed(True)
+        elif tok == DB_FLAG:
+            value = next(it, None)
+            if not value or value.startswith("-"):
+                raise ValueError(f"{DB_FLAG} requires a store path")
+            set_db(value)
+        elif tok.startswith(DB_FLAG + "="):
+            value = tok[len(DB_FLAG) + 1:]
+            if not value:
+                raise ValueError(f"{DB_FLAG}= requires a store path")
+            set_db(value)
+        elif tok.startswith("--") and len(tok) > 2:
+            raise ValueError(
+                f"unknown flag {tok!r}: the estate shim accepts {READONLY_FLAG}, "
+                f"{GOVERNED_FLAG} and {DB_FLAG} <path> only (spell {READONLY_FLAG} exactly)"
+            )
+        else:
+            rest.append(tok)
+    return rest
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Transport seam — spawn-per-call today; swappable for a broker later
 # ─────────────────────────────────────────────────────────────────────────────
@@ -139,14 +323,15 @@ def _dispatch(requests: list, *, db: Optional[str], timeout: float) -> dict:
     its `id`. Notifications (no `id`) produce no output and are simply absent.
 
     Fail-open: any failure returns {} — the caller treats a missing id as a
-    dead call and degrades.
+    dead call and degrades. A governed run with no pinned store never spawns
+    (`governed_refusal`).
     """
+    if governed_refusal():
+        return {}
     exe = resolve_mcp_bin()
     if not exe:
         return {}
-    argv = [exe]
-    if db:
-        argv += ["--db", db]
+    argv = mcp_argv(exe, db)
     payload = "".join(json.dumps(r, separators=(",", ":")) + "\n" for r in requests)
     try:
         proc = subprocess.Popen(
@@ -240,6 +425,7 @@ class _PersistentBroker:
         self._proc: Optional[subprocess.Popen] = None   # type: ignore[type-arg]
         self._init_resp: Optional[dict] = None           # cached after handshake
         self._db: Optional[str] = None                   # db the process was started with
+        self._readonly: bool = False                      # mode the process was started in
         self._q: queue.Queue = queue.Queue()             # response lines from reader thread
         self._failed: bool = False                        # permanent-degrade flag
         self._reconnect_used: bool = False               # one reconnect per lifetime
@@ -252,9 +438,8 @@ class _PersistentBroker:
         exe = resolve_mcp_bin()
         if not exe:
             return False
-        argv = [exe]
-        if db:
-            argv += ["--db", db]
+        readonly = read_only()
+        argv = mcp_argv(exe, db)
 
         # Fresh queue per session: a previous reader thread may enqueue an EOF
         # sentinel *after* any drain loop runs, corrupting the new session.
@@ -312,6 +497,7 @@ class _PersistentBroker:
         self._proc = proc
         self._init_resp = resp
         self._db = db
+        self._readonly = readonly
         return True
 
     @staticmethod
@@ -418,16 +604,17 @@ class _PersistentBroker:
 
     def _locked(self, requests: list, *, db: Optional[str], timeout: float) -> dict:
         """Called under self._lock. Returns {id: response}, {} on any failure."""
-        if self._failed:
+        if self._failed or governed_refusal():
             return {}
 
         # Ensure the process is running. Three cases:
         #  (a) First start: no process, no init_resp yet — start freely.
         #  (b) Unexpected death between calls: process gone, init_resp present —
         #      consumes the one reconnect budget; degrade if budget exhausted.
-        #  (c) Planned restart: DB changed while process is still alive —
-        #      close + restart, NOT counted against the reconnect budget.
-        if not self._is_alive() or self._db != db:
+        #  (c) Planned restart: DB or read-only mode changed while the process is
+        #      still alive — close + restart, NOT counted against the budget.
+        mode_changed = self._db != db or self._readonly != read_only()
+        if not self._is_alive() or mode_changed:
             previously_started = self._init_resp is not None
             if not self._is_alive() and previously_started:
                 # Case (b): death between calls.
@@ -435,8 +622,8 @@ class _PersistentBroker:
                     self._failed = True
                     return {}
                 self._reconnect_used = True
-            elif self._is_alive() and self._db != db:
-                # Case (c): DB changed — close old process before restarting.
+            elif self._is_alive() and mode_changed:
+                # Case (c): DB / mode changed — close old process before restarting.
                 self._close()
             if not self._start(db):
                 # Only mark permanently failed when this is a reconnect path
@@ -692,6 +879,42 @@ def knowledge_recall(query: str, token_budget: int = 2000, timeout: float = 8.0)
     return call("knowledge.recall", {"query": query, "token_budget": token_budget}, timeout=timeout)
 
 
+def propose(
+    kind_type: str,
+    payload: dict,
+    facets: Optional[dict] = None,
+    timeout: float = 8.0,
+) -> dict:
+    """Submit one inert proposal → estate `proposal.submit` (the safe write a
+    `--readonly` MCP still permits; it lands `pending` until an operator approves).
+
+    Returns ``{"ok": True, "id": <proposal-id>}`` or ``{"ok": False, "reason": …,
+    "code": <json-rpc code | None>}`` so a caller can tell a shape error (-32602 —
+    fix the args and resubmit) from an unreachable estate (code None — keep the
+    objects in the deliverable file / report instead). `provenance` is NEVER sent:
+    the server stamps it from its own `WICKED_RUN_*` environment.
+    """
+    arguments: dict = {"kind_type": kind_type, "payload": payload}
+    if facets:
+        arguments["facets"] = facets
+    envelope = call_raw("proposal.submit", arguments, timeout=timeout)
+    if envelope is None:
+        return {"ok": False, "reason": "estate unreachable (proposal.submit did not round-trip)",
+                "code": None}
+    error = envelope.get("error")
+    if isinstance(error, dict):
+        return {"ok": False, "reason": error.get("message") or "proposal.submit failed",
+                "code": error.get("code")}
+    result = _unwrap(envelope)
+    if isinstance(result, dict) and result.get("id"):
+        return {"ok": True, "id": result["id"]}
+    text = None
+    content = (envelope.get("result") or {}).get("content") if isinstance(envelope.get("result"), dict) else None
+    if isinstance(content, list) and content and isinstance(content[0], dict):
+        text = content[0].get("text")
+    return {"ok": False, "reason": text or "proposal.submit returned no id", "code": None}
+
+
 def stats(timeout: float = 8.0) -> Optional[dict]:
     """Index summary → the `wicked-estate stats` CLI, parsed to a dict.
 
@@ -735,22 +958,44 @@ def stats(timeout: float = 8.0) -> Optional[dict]:
 
 # ─────────────────────────────────────────────────────────────────────────────
 # CLI — the `wicked-estate-call` entry for non-Python / shell / markdown callers
-#   python3 scripts/_estate_client.py <action> [json-args]
+#   python3 scripts/_estate_client.py [--readonly] [--governed] [--db <path>] <action> [json-args]
 # Prints JSON to stdout; exit 0 always on a clean (even empty) result, 1 only on
 # a usage error. Never crashes a caller.
 # ─────────────────────────────────────────────────────────────────────────────
 
+_USAGE = (
+    "usage: _estate_client.py [--readonly] [--governed] [--db <path>] "
+    "<health|mode|search|context|recall|knowledge-recall|stats|list-tools|call|propose> "
+    "[json-args]"
+)
+
+
 def _emit(obj: Any) -> None:
     sys.stdout.write(json.dumps(obj))
     sys.stdout.write("\n")
 
 
 def main(argv: list) -> int:
+    try:
+        argv = parse_cli_flags(argv)
+    except ValueError as exc:
+        _emit({"error": f"{exc}; {_USAGE}"})
+        return 1
     if not argv:
-        _emit({"error": "usage: _estate_client.py <health|search|context|recall|"
-                        "knowledge-recall|stats|list-tools|call> [json-args]"})
+        _emit({"error": _USAGE})
         return 1
     action = argv[0]
+    if action == "mode":
+        # A pure local probe — reports the mode without spawning, refusal included.
+        _emit({"governed": is_governed(), "marker": governed_marker(),
+               "readonly": read_only(), "store_pinned": store_pinned(),
+               "db": resolve_db(), "refusal": governed_refusal()})
+        return 0
+    refusal = governed_refusal()
+    if refusal:
+        # Fail-open shape (exit 0): a degrade the worker reports, not a crash.
+        _emit({"ok": False, "reason": refusal, "governed": True})
+        return 0
     raw = argv[1] if len(argv) > 1 else "{}"
     try:
         args = json.loads(raw) if raw else {}
@@ -784,8 +1029,17 @@ def main(argv: list) -> int:
             _emit({"error": "call requires {\"tool\": \"<ToolName>\", \"arguments\": {...}}"})
             return 1
         _emit({"result": call(tool, args.get("arguments", {}))})
+    elif action == "propose":
+        kind_type = args.get("kind_type")
+        payload = args.get("payload")
+        if not isinstance(kind_type, str) or not kind_type or not isinstance(payload, dict):
+            _emit({"error": 'propose requires {"kind_type": "memory"|"policy:<type>", '
+                            '"payload": {...}, "facets": {...}?} — never "provenance"'})
+            return 1
+        # `provenance` is deliberately not forwarded (server-stamped from WICKED_RUN_*).
+        _emit(propose(kind_type, payload, args.get("facets")))
     else:
-        _emit({"error": f"unknown action: {action}"})
+        _emit({"error": f"unknown action: {action}; {_USAGE}"})
         return 1
     return 0